[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/new-toolset-targets-middle-east-africa-usa/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# New Tool Set Found Used Against Organizations in the Middle East, Africa and the US

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Chema Garcia](https://unit42.paloaltonetworks.com/author/chema-garcia/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:December 1, 2023

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [.NET Framework](https://unit42.paloaltonetworks.com/tag/net-framework/)
  * [Agent Raccoon](https://unit42.paloaltonetworks.com/tag/agent-raccoon/)
  * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/)
  * [CL-STA-0002](https://unit42.paloaltonetworks.com/tag/cl-sta-0002/)
  * [CL-STA-0043](https://unit42.paloaltonetworks.com/tag/cl-sta-0043/)
  * [Mimikatz](https://unit42.paloaltonetworks.com/tag/mimikatz/)
  * [Mimilite](https://unit42.paloaltonetworks.com/tag/mimilite/)
  * [Ntospy](https://unit42.paloaltonetworks.com/tag/ntospy/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/?pdf=download&lg=en&_wpnonce=c280d701ab "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/?pdf=print&lg=en&_wpnonce=c280d701ab "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=New%20Tool%20Set%20Found%20Used%20Against%20Organizations%20in%20the%20Middle%20East,%20Africa%20and%20the%20US&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F&title=New%20Tool%20Set%20Found%20Used%20Against%20Organizations%20in%20the%20Middle%20East,%20Africa%20and%20the%20US "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F&text=New%20Tool%20Set%20Found%20Used%20Against%20Organizations%20in%20the%20Middle%20East,%20Africa%20and%20the%20US "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=New%20Tool%20Set%20Found%20Used%20Against%20Organizations%20in%20the%20Middle%20East,%20Africa%20and%20the%20US%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-toolset-targets-middle-east-africa-usa%2F "Share in Mastodon")

## **Executive Summary**

Unit 42 researchers observed a series of apparently related attacks against organizations in the Middle East, Africa and the U.S. We will discuss a set of tools used in the course of the attacks that reveal clues about the threat actors' activity. We are sharing this research to provide detection, prevention and hunting recommendations to help organizations strengthen their overall security posture.

These tools were used to perform the following activities:

* Establish backdoor capabilities
* For command and control (C2)
* Steal user credentials.
* Exfiltrate confidential information

Unit 42 is sharing these results with the purpose of helping organizations defend against the tools observed here.

We assess with medium confidence that this threat activity cluster aligns to nation-state related threat actors due to the nature of the organizations that were compromised, the TTPs observed and the customization of the tool set. We have not confirmed a particular nation-state or threat group.

Tools that were used in this cluster were the following:

* A new backdoor we've named Agent Racoon
  * This malware family is written using the .NET framework and leverages the domain name service (DNS) protocol to create a covert channel and provide different backdoor functionalities. Threat actors have used this along with the other two tools in multiple attacks targeting organizations across the U.S., Middle East and Africa. Its C2 infrastructure dates back to 2020.
* A new tool we've named Ntospy
  * This malware is a Network Provider DLL module designed to steal user credentials.
* A customized version of Mimikatz called Mimilite

The compromised organizations belong to the following industries:

* Education
* Real estate
* Retail
* Non-profit organizations
* Telecom companies
* Governments

Based on unique similarities in tools as well as tactics, techniques and procedures (TTPs), we are tracking this [threat activity cluster](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) as CL-STA-0002.

What follows is a detailed description of the activity we observed as well as characteristics of the tool set.

Palo Alto Networks customers receive protection from these threats through [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) as well as [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration), [DNS Security](https://docs.paloaltonetworks.com/dns-security) and [Advanced Wildfire](https://docs.paloaltonetworks.com/wildfire). Organizations can engage the Unit 42 Incident Response team for specific assistance with this threat and others.

| **Related Unit 42 Topics** | [**DNS**](https://unit42.paloaltonetworks.com/tag/dns/), **[Mimikatz](https://unit42.paloaltonetworks.com/tag/mimikatz/), [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/)** |
|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

## **Activity Summary**

The threat actor used temporary directories such as C:\\Windows\\Temp and C:\\Temp to deploy specific components of their tool set across the different affected organizations. They used the following similar filenames for batch and PowerShell scripts:

* c:\\windows\\temp\\crs.ps1
* c:\\windows\\temp\\ebat.bat
* c:\\windows\\temp\\install.bat
* c:\\windows\\temp\\mslb.ps1
* c:\\windows\\temp\\pb.ps1
* c:\\windows\\temp\\pb1.ps1
* c:\\windows\\temp\\pscan.ps1
* c:\\windows\\temp\\set\_time.bat
* c:\\windows\\temp\\usr.ps1

While the attackers commonly used [Ntospy](#post-131403-_wven14kmgum2) across the affected organizations, the [Mimilite](https://unit42.paloaltonetworks.com/?p=131403&preview=true#post-131403-_uoz73eltqdwp) tool and the [Agent Racoon](#post-131403-_50t4n6xlnq0) malware have only been found in nonprofit and government-related organizations' environments.

After each attack session, the threat actor leveraged cleanmgr.exe to clean up the environment used during the session.

## **Gaining Access to Credentials with Ntospy**

To perform credential theft, the threat actor used a custom DLL module implementing a [Network Provider](https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api). A Network Provider module is a DLL component implementing the interface provided by Microsoft to support additional types of network protocols during the authentication process.

This technique is pretty well documented. Sergey Polak demonstrated the technique at BlackHat back in 2004 at his session titled "[Capturing Windows Passwords using the Network Provider API](https://www.blackhat.com/presentations/win-usa-04/bh-win-04-polak/bh-win-04-polak2.pdf)." In 2020, researcher [Grzegorz Tworek](https://twitter.com/0gtweet) uploaded his tool [NPPSpy](https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy) to GitHub, which also implements this technique.

Due to the file naming patterns of the DLL module, and as a reference to the previous research and tools, Unit 42 researchers named this malware family Ntospy. The threat actor registers the Ntospy DLL module as a Network Provider module to hijack the authentication process, to get access to the user credentials every time the victim attempts to authenticate to the system.

Figure 1 illustrates the path of the processes the malware used during the authentication process to load the malicious DLL module in an MS Exchange Server environment.
![Image 1 is a screenshot of the different paths of the processes loading the DLL module in the Microsoft Exchange Server environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-1.png) Figure 1. Image path of processes loading the malicious DLL component in an MS Exchange environment.

The threat actor's implementation of this technique has some unique features. They created different versions of the Ntospy malware over the time frame we observed. They all share similarities, such as the following:

* Using filenames with Microsoft patch patterns.
* .msu extensions pretending to be Microsoft Update Package files to store the received credentials in cleartext.
* RichPE header hashes that link different samples to the same compilation environment.

To install the DLL module, the threat actor registers a new Network Provider called credman. They do so by using an installation script found at C:\\Windows\\Temp\\install.bat that installs the Network Provider by using reg.exe. The malware then sets the DLL module path by pointing to the malicious DLL module c:\\windows\\system32\\ntoskrnl.dll.

![Many lines of code. Attacker registers as credman.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-2.png)

Figure 2 shows static commonalities across the different DLL modules we identified as belonging to the same malware family. The image also illustrates that there are overlaps on the RichPE header hash as well as the PE sections of the samples.
![Image 2 is a diagram of the static features as they relate across samples. Dark grey arrows leading from orange top-level icons point to red mid-level icons in the shape pf a virus. These in turn use light grey arrows to point to icons of files.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-3.png) Figure 2. Graph of static features relation across samples.

In the group of samples with the same RichPE header hash, we saw that they had been compiled using the same environment. In this case, that was Visual Studio 2019 v16.0.0 build 27508. Other samples of the malware family have been compiled on different environments or even tweaked to avoid overlapping.

The samples that don't share the same build environment are actually similar in behavior, but they have some differences in implementation. For instance, some of the malware samples contain the file path used to store the credentials hard-coded in plain text. Figures 3 and 4 show how others use an encrypted file path and stack strings.
![Image 3 is a screenshot of many lines of code. It is the pseudocode showing the hard-coded file path as indicated by a red arrow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-4.png) Figure 3. Pseudocode showing the hard-coded file path in cleartext. ![Image 4 is a screenshot of many lines of code. It is the pseudocode showing the encrypted file path as indicated by a red arrow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-5.png) Figure 4. Pseudocode showing the file path encrypted with a stream cipher.

Decrypting the file path at runtime shows that the versions using an encrypted file path also use the same file path pattern, as shown in Figure 5.
![Image 5 is a screenshot of the file path decrypted at runtime. There are three columns visible: Address, Hex, ASCII.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-6.png) Figure 5. File path decrypted at runtime.

All the DLL modules we identified use the same file path pattern, abusing the .msu file extension to masquerade as a Microsoft Update Package. The following paths are used by the malware samples:

* c:/programdata/microsoft/~ntuserdata.msu
* c:/programdata/package cache/windows10.0-kb5000736-x64.msu
* c:/programdata/package cache/windows10.0-kb5009543-x64.msu
* c:/programdata/packag~1/windows 6.1-kb4537803.msu

Also, the DLL files are stored in the following file paths:

* C:\\Windows\\System32\\ntoskrnl.dll
* C:\\Windows\\Temp\\ntoskrnl.dll
* C:\\Windows\\Temp\\ntos.dll

While the first file path is the one used to actually install the Network Provider module, the Temp directory is the working directory used by the threat actor to temporarily store the DLL modules. As shown in the file paths above, the threat actor used Windows binary name patterns (based on the Windows system file named ntoskrnl.exe) in an attempt to trick victims and analysts into overlooking the malicious DLL component.

The first activity is identified with the malware sample with the file hash SHA256 bcd2bdea2bfecd09e258b8777e3825c4a1d98af220e7b045ee7b6c30bf19d6df. This overlaps with [another threat activity cluster](https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/) that we call CL-STA-0043, originally published in June 2023.

## Credentials Dumping Through Mimilite

Another tool used for gathering credentials and sensitive information is a customized version of the well-known Mimikatz tool that, according to references within the sample, the threat actor calls Mimilite.

The tool is a reduced version of Mimikatz, which needs to be given a password through the command line to run:  
C:\\temp\\update.exe 1dsfjlosdf23dsfdfr

|---|-----------------------------------------|
| 1 | C:\\temp\\update.exe 1dsfjlosdf23dsfdfr |

When the binary is executed, it takes the command-line argument as a decryption key to decrypt the actual payload using a stream cipher. Before executing the decrypted payload, the binary verifies that the payload has been successfully decrypted with the right key by performing an integrity check. This check is done by comparing the MD5 hash of the decrypted payload with the hard-coded value b855dfde7f778f99a3724802715a0baa, as shown in the code snippet in Figure 6.
![Image 6 is a screenshot of many lines of code. Three red arrows indicate the execution logic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-7.png) Figure 6. Execution logic.

When executed properly, the tool dumps the credentials to the file path C:\\Windows\\Temp\\KB200812134.txt. This choice of filename is another attempt by the threat actors to masquerade as a Microsoft update.

The Mimilite sample was found at C:\\temp\\update.exe with the file hash SHA256 3490ba26a75b6fb295256d077e0dbc13e4e32f9fd4e91fb35692dbf64c923c98. It was first uploaded to VirusTotal on 2020-05-11 05:43:00 UTC and first identified in the wild on 2021-02-12 21:54:35 UTC. What we find interesting is that according to VirusTotal, this sample has been uploaded and discovered in the wild using the following path and filename:  
C:\\restrict\\analysis\\apt\_sorted\\attack\_case\\\[REDACTED\_LOCATION\]\\\[REDACTED\_COUNTRY\_ISO\_CODE\]-computers\\blobloader\\3490ba26a75b6fb295256d077e0dbc13e4e32f9fd4e91fb35692dbf64c923c98 update.exe

|-------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 | C:\\restrict\\analysis\\apt\_sorted\\attack\_case\\\[REDACTED\_LOCATION\]\\\[REDACTED\_COUNTRY\_ISO\_CODE\]-computers\\blobloader\\3490ba26a75b6fb295256d077e0dbc13e4e32f9fd4e91fb35692dbf64c923c98 update.exe |

The elements of this path might suggest that the same binary has been involved in some sort of research that the uploader believed was linked with nation-state actors.

## **Agent Racoon Backdoor**

The Agent Racoon malware family is built to provide backdoor capabilities. It is written using the .NET framework, and leverages DNS to establish a covert channel with the C2 server. Unit 42 researchers named the malware family Agent Racoon due to some references found within the code of the identified samples, as shown in Figure 7.
![Image 7 is a screenshot of the .NET project details. There are entries for Assembly name, which is raccoon; Default namespace, which is agent; Target framework, which is .NET Framework 4; Output type, which is Console Application; and Startup object, which is agent.Program. Auto-generate binding redirects is not selected.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-8.png) Figure 7. .NET Project details.

When executed, the threat has some predefined settings such as:

* The base domain used to create the DNS covert channel
* A unique key per sample, used as a seed to generate an encryption password to encrypt the DNS communication
* A fallback DNS server if no DNS server can be read from the compromised system

All the C2 domains identified fulfill the same base pattern, with unique values for the four character identifier across different samples:

\[4 characters\].telemetry.\[domain\].com

The value of Program.dns\_ip is different for each sample found, which could indicate that the threat actor is building the binary with specific settings gathered from the targeted environment.
![Image 8 is a screenshot of many lines of code. Three red arrows indicate the main function of the malware sample.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-9.png) Figure 8. Main function of the malware sample.

With that pattern, the threat communicates with the C2 server by adding additional subdomains to build the DNS query. It uses Internationalizing Domain Names for Applications' (IDNA) domain names with Punycode encoding. This encoding type is a representation of Unicode values over the ASCII encoding for internet hostnames.

The domain names follow the pattern below:

\[random\_val\].a.\[4 characters\].telemetry.\[domain\].com

The screenshot from Wireshark in Figure 9 illustrates a complete DNS query:
![Image 9 is a screenshot of many lines of code. Indicated by a red bracket is the sample DNS query.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-10.png) Figure 9. Sample DNS query.

To manage the communication with the C2 server, the malware uses a communication loop shown in Figure 10.
![Image 10 is a screenshot of many lines of code. Four red arrows indicate the communication loop.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-11.png) Figure 10. Communication loop.

The following are some main features of the communication loop above:

* The communication loop finishes when the answer xn--cc is received from the C2 server, or a communication error occurs.
* The randomized delay between messages can have multiple reasons:
  * To avoid network spikes.
  * To avoid potential network congestion.
  * To provide randomness as an attempt to avoid network beaconing detection.
* The encryption of all the communication messages through Program.Util.RC.

The encryption routine implements a stream cipher that takes the initial unique key per sample Program.key (this.defaultkey), as shown in Figure 11. It then creates a 1-byte encryption key to later encrypt the message with an XOR.
![Image 11 is a screenshot of many lines of code. Two red arrows point to instances of (this.defaultkey) and one red arrow points to the “message” line inside brackets.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-12.png) Figure 11. Stream cipher routine.

Depending on the length of the message sent to the C2 server, different subdomains are added to the query, as shown in the code snippet in Figure 12.
![Image 12 is a screenshot of many lines of code. Indicated by a red bracket is the crafting of a partial request.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-13.png) Figure 12. Partial request crafting.

The this.Rand() component of the fully qualified domain name (FQDN) build is intended to avoid caching and ensure the request reaches out to the C2 server.

Agent Racoon provides the following backdoor functionality:

* Command execution
* File uploading
* File downloading

Although Agent Racoon does not provide any sort of persistence mechanism by itself, during the activity we observed, the threat was executed by using scheduled tasks.

Unit 42 researchers discovered the following samples using different subdomains of telemetry.geoinfocdn\[.\]com, as shown in Figure 13. The domain geoinfocdn\[.\]com was registered on 2022/08/19 UTC for one year.
![Image 13 is a hierarchy diagram of the malware samples linked to the file bath and the base command and control domain.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-14.png) Figure 13. Samples linked with file path and base C2 domain.

Unit 42 researchers were able to track the Agent Racoon malware family back to July 2022. Two samples of the malware family were uploaded to VirusTotal from Egypt and Thailand in September 2022 and July 2022 with the following SHA256 hashes:

* 3a2d0e5e4bfd6db9c45f094a638d1f1b9d07110b9f6eb8874b75d968401ad69c
* dee7321085737da53646b1f2d58838ece97c81e3f2319a29f7629d62395dbfd1

These two samples used the same subdomain patterns, but this time the domain used for C2 was telemetry.geostatcdn\[.\]com. Threat actors performed the following activities regarding this domain on the dates shown:

* Registered: 2020/08/27 UTC
* First seen in the wild: 2021/06/17 23:10:58 UTC
* Renewed: 2021/08/18 UTC
* Expired: 2022/08/27 UTC

Figure 14 shows that with this information, two groups of malware samples can be identified using different C2 domain names and file paths since 2020.
![Image 14 is a hierarchy diagram of the malware samples linked to the file path and the base command and control domain.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-15.png) Figure 14. Malware samples identified.

The threat actor tried to disguise the Agent Racoon binary as Google Update and MS OneDrive Updater binaries.

The malware developers made small modifications to the source code in an attempt to evade detection. Some samples used a domain hard-coded in plain text to establish the DNS covert channel (as shown in Figure 15), whereas other samples used a Base64 encoded string.
![Image 15 is a screenshot of many lines of code. Red arrows indicate the command and control domain string.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-16.png) Figure 15. Base64 encoded C2 domain.

Aside from the Base64 feature, the differences are in the settings and not in the actual source code, except for the sample with SHA256 hash 354048e6006ec9625e3e5e3056790afe018e70da916c2c1a9cb4499f83888a47.

This sample has a compilation timestamp that was modified and is outside the time frame of activity: 2075/02/23 08:12:59 UTC.

As shown in Figure 16, the threat actor also tried to obfuscate the constant cmd.exe to avoid signature-based detections. They did so by using the equivalent Base64 encoded value with the added constant 399 so the equivalent Base64 encoded string can't be detected through signatures.
![Image 16 is two screenshots side by side. Red arrows point to the obfuscated cmd.exe pattern found in the samples.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-17.png) Figure 16. Obfuscated cmd.exe pattern.

## **Data Exfiltration**

Unit 42 researchers also identified the collection and successful exfiltration of confidential information, such as emails from MS Exchange environments, using PowerShell snap-ins to dump the emails.

![PowerShell snap-in code to dump emails](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-18.png)

In the search criteria from the command above, the threat actor used similar commands to search through different folders, mailboxes and dates to dump those emails.

After dumping the emails, the threat actor tried to compress the .pst file with a command-line RAR tool before exfiltrating it:

![Command-line RAR tool to compress the .pst file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-19.png)

However, the threat actor canceled the attempt to compress the .pst file by using the tool taskkill.exe approximately eight minutes later.

![PowerShell snap-in code to dump emails](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-20.png)

Eventually the threat actor discarded the usage of raren.exe and simply renamed the .pst file, moving it to the IIS root directory and mimicking an error log in a compressed file to download it through the web server.

![Command-line RAR tool to compress the .pst file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-21.png)

And finally, the ai.pst file is removed.

![Use of tool taskkill to cancel the compression attempt.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-22.png)

This process is repeated for several mailboxes with different search criteria.

In addition to the email exfiltration, Unit 42 researchers identified exfiltration of the victim's [Roaming Profile](https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview). A Roaming Profile is used to serve the same profile to the user when logging in from different computers from the same Active Directory environment.

To exfiltrate this, the threat actor compressed the directory by using the standalone version of the 7-Zip tool (which they dropped into the system using certutil.exe), and split the compressed file into chunks of 100 MB.

![Removing the ai dot pst file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-23.png)

![Compressing the directory. Splitting the file into segments of 100 MB.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-24.png)

Later, following the same procedure, the threat actor exfiltrated the content.

![Exfiltration of content.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131403-25.png)

## **Conclusion**

Our hope in sharing the descriptions of this tool set is that readers can use this information to search their networks to identify other possible attacks using these tools. This tool set is not yet associated with a specific threat actor, and not entirely limited to a single cluster or campaign.

As mentioned at the beginning of this article, we found an overlapping Ntospy sample with SHA256 bcd2bdea2bfecd09e258b8777e3825c4a1d98af220e7b045ee7b6c30bf19d6df with a [previously identified](https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/) threat activity cluster CL-STA-0043. However, the overlaps are not limited to that sample.

We have also identified two compromised organizations in common across both activity clusters. Some of the TTPs match on both clusters, such as the MS Exchange PowerShell snap-ins and one of the Network Provider DLL modules.

Unit 42 researchers believe this threat activity cluster aligns with medium confidence to nation-state related threat actors for the following reasons:

* The detection and defense evasion techniques used
* The exfiltration activity observed
* The victimology
* The customization level of the tools used
* The TTPs observed

Palo Alto Networks customers receive protections from the threats discussed above through the following products:

* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) includes detections and protections related to the IoCs shared in this research
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) blocks related C2 domains as malicious
* The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research

If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America Toll-Free: 866.486.4842 (866.4.UNIT42)
* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

**MITRE ATT\&CK Mapping**

During the research activity related to the tool set uncovered on this blog, Unit 42 researchers identified a set of TTPs, which we've mapped to the MITRE ATT\&CK matrix in the table below.

|-----------|----------------------------------------------------------|
| **ID**    | **Name**                                                 |
| T1003     | OS Credential Dumping                                    |
| T1018     | Remote System Discovery                                  |
| T1021.006 | Remote Services: Windows Remote Management               |
| T1027.009 | Obfuscated Files or Information: Embedded Payloads       |
| T1030     | Data Transfer Size Limits                                |
| T1036.005 | Masquerading: Match Legitimate Name or Location          |
| T1036.008 | Masquerading: Masquerade File Type                       |
| T1041     | Exfiltration Over C2 Channel                             |
| T1046     | Network Service Discovery                                |
| T1047     | Windows Management Instrumentation                       |
| T1053.005 | Scheduled Task/Job: Scheduled Task                       |
| T1059.001 | Command and Scripting Interpreter: PowerShell            |
| T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| T1070.004 | Indicator Removal: File Deletion                         |
| T1070.006 | Indicator Removal: Timestomp                             |
| T1071.004 | Application Layer Protocol: DNS                          |
| T1074     | Data Staged                                              |
| T1078.002 | Valid Accounts: Domain Accounts                          |
| T1087.002 | Account Discovery: Domain Account                        |
| T1112     | Modify Registry                                          |
| T1114     | Email Collection                                         |
| T1132.001 | Data Encoding: Standard Encoding                         |
| T1136.002 | Create Account: Domain Account                           |
| T1140     | Deobfuscate/Decode Files or Information                  |
| T1505.003 | Server Software Component: Web Shell                     |
| T1556.008 | Modify Authentication Process: Network Provider DLL      |
| T1560.001 | Archive Collected Data: Archive via Utility              |
| T1564.002 | Hide Artifacts: Hidden Users                             |
| T1570     | Lateral Tool Transfer                                    |
| T1573.001 | Encrypted Channel: Symmetric Cryptography                |
| T1583.001 | Acquire Infrastructure: Domains                          |
| T1583.002 | Acquire Infrastructure: DNS Server                       |
| T1587.001 | Develop Capabilities: Malware                            |

## **Indicators of Compromise**

|------------------------------------------------------------------|-----------------------|--------------------------------------------------------------|
| **IoC**                                                          | **Type**              | **Description**                                              |
| 2632bcd0715a7223bda1779e107087964037039e1576d2175acaf61d3759360f | SHA256                | C:\\Windows\\Temp\\install.bat                               |
| ae989e25a50a6faa3c5c487083cdb250dde5f0ecc0c57b554ab77761bdaed996 | SHA256                | C:\\Windows\\Temp\\install.bat                               |
| C:\\Windows\\Temp\\install.bat                                   | File path             | Script to install the Network Provider module                |
| c:/programdata/microsoft/~ntuserdata.msu                        | File path             | File to store the stolen user credentials                    |
| c:/programdata/packag~1/windows 6.1-kb4537803.msu               | File path             | File to store the stolen user credentials                    |
| c:/programdata/package cache/windows10.0-kb5009543-x64.msu       | File path             | File to store stolen user credentials                        |
| c:/programdata/package cache/windows10.0-kb5000736-x64.msu       | File path             | File to store stolen user credentials                        |
| credman                                                          | Network provider name | Network Provider name                                        |
| HKLM\\SYSTEM\\CurrentControlSet\\Services\\credman               | Registry key path     | Registry path of the Network Provider                        |
| c:\\windows\\system32\\ntoskrnl.dll                              | File path             | Network Provider module file path                            |
| C:\\Windows\\Temp\\ntos.dll                                      | File path             | File path used to temporarily store the DLL module           |
| C:\\Windows\\Temp\\ntoskrnl.dll                                  | File path             | File path used to temporarily store the DLL module           |
| e30f8596f1beda8254cbe1ac7a75839f5fe6c332f45ebabff88aadbce3938a19 | SHA256                | Ntospy DLL Module                                            |
| 1a4301019bdf42e7b2df801e04066a738d184deb22afcad9542127b0a31d5cfa | SHA256                | Ntospy DLL Module                                            |
| e7682a61b6c5b0487593f880a09d6123f18f8c6da9c13ed43b43866960b7aa8e | SHA256                | Ntospy DLL Module                                            |
| 58e87c0d9c9b190d1e6e44eae64e9a66de93d8de6cbd005e2562798462d05b45 | SHA256                | Ntospy DLL Module                                            |
| 7eb901a6dbf41bcb2e0cdcbb67c53ab722604d6c985317cb2b479f4c4de7cf90 | SHA256                | Ntospy DLL Module                                            |
| f45ea12579f636026d29009190221864f432dbc3e26e73d8f3ab7835fa595b86 | SHA256                | Ntospy DLL Module                                            |
| bcd2bdea2bfecd09e258b8777e3825c4a1d98af220e7b045ee7b6c30bf19d6df | SHA256                | Ntospy DLL Module                                            |
| C:\\temp\\update.exe                                             | File path             | Mimilite                                                     |
| 1dsfjlosdf23dsfdfr                                               | Encryption key        | Mimilite decryption key                                      |
| b855dfde7f778f99a3724802715a0baa                                 | MD5                   | Mimilite payload hash                                        |
| 4351911f266eea8e62da380151a54d5c3fbbc7b08502f28d3224f689f55bffba | SHA256                | Agent Racoon                                                 |
| e0748ce315037253f278f7f8f2820c7dd8827a93b6d22d37dafc287c934083c4 | SHA256                | Agent Racoon                                                 |
| baed169ce874f6fe721e0d32128484b3048e9bf58b2c75db88d1a8b7d6bb938d | SHA256                | Agent Racoon                                                 |
| 3a2d0e5e4bfd6db9c45f094a638d1f1b9d07110b9f6eb8874b75d968401ad69c | SHA256                | Agent Racoon                                                 |
| 4351911f266eea8e62da380151a54d5c3fbbc7b08502f28d3224f689f55bffba | SHA256                | Agent Racoon                                                 |
| 354048e6006ec9625e3e5e3056790afe018e70da916c2c1a9cb4499f83888a47 | SHA256                | Agent Racoon                                                 |
| dee7321085737da53646b1f2d58838ece97c81e3f2319a29f7629d62395dbfd1 | SHA256                | Agent Racoon                                                 |
| geostatcdn\[.\]com                                               | Domain                | C2                                                           |
| telemetry.geostatcdn\[.\]com                                     | Domain                | C2                                                           |
| fdsb.telemetry.geostatcdn\[.\]com                                | Domain                | C2                                                           |
| dlbh.telemetry.geostatcdn\[.\]com                                | Domain                | C2                                                           |
| lc3w.telemetry.geostatcdn\[.\]com                                | Domain                | C2                                                           |
| hfhs.telemetry.geostatcdn\[.\]com                                | Domain                | C2                                                           |
| geoinfocdn\[.\]com                                               | Domain                | C2                                                           |
| telemetry.geoinfocdn\[.\]com                                     | Domain                | C2                                                           |
| g1sw.telemetry.geoinfocdn\[.\]com                                | Domain                | C2                                                           |
| c:/windows/temp/onedriveupdater.exe                              | File path             | Agent Racoon path                                            |
| c:/windows/system32/msmdlb.exe                                   | File path             | Agent Racoon path                                            |
| c:/windows/temp/onedriveupdater.exe                              | File path             | Agent Racoon path                                            |
| c:/program files (x86)/google/update/googleupdate.exe            | File path             | Agent Racoon path                                            |
| c:\\windows\\temp\\mslb.ps1                                      | File path             | Script used to deploy the Agent Racoon                       |
| c:\\windows\\temp\\set\_time.bat                                  | File path             | Script used to perform timestomping against additional tools |
| c:\\windows\\temp\\pscan.ps1                                     | File path             | Script to scan the network                                   |
| c:\\windows\\temp\\crs.ps1                                       | File path             | Helper script                                                |
| c:\\windows\\temp\\usr.ps1                                       | File path             | Helper script                                                |
| c:\\windows\\temp\\pb.ps1                                        | File path             | Helper script                                                |
| c:\\windows\\temp\\ebat.bat                                      | File path             | Helper script                                                |
| c:\\windows\\temp\\pb1.ps1                                       | File path             | Helper script                                                |
| c:\\windows\\temp\\raren.exe                                     | File path             | Command line RAR                                             |
| aabbcc123                                                        | Password              | Password used to create the email archive                    |
| 086a6618705223a8873448465717e288cf7cc6a3af4d9bf18ddd44df6f400488 | SHA256                | raren.exe file hash                                          |
| P@ssw0rd1                                                        | Password              | Password used to compress the user profile directory         |
| Assistance$                                                      | Username              | User created for persistence                                 |
| Zaqwsx123                                                        | Password              | User created for persistence                                 |

## **Additional Resources**

* [It's All in the Name: How Unit 42 Defines and Tracks Threat Adversaries](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) -- Unit 42, Palo Alto Networks
* [Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa](https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/) -- Unit 42, Palo Alto Networks
* [NPPSpy](https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy) - NPPSpy GitHub repository
* [Capturing Windows Passwords using the Network Provider API](https://www.blackhat.com/presentations/win-usa-04/bh-win-04-polak/bh-win-04-polak2.pdf) - BlackHat 2004
* [Network Provider API](https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api) - Microsoft
* [NPLogonNotify](https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify) - Microsoft
* [Roaming Profiles](https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview) - Microsoft
  Back to top

### Tags

* [.NET Framework](https://unit42.paloaltonetworks.com/tag/net-framework/ ".NET Framework")
* [Agent Raccoon](https://unit42.paloaltonetworks.com/tag/agent-raccoon/ "Agent Raccoon")
* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")
* [CL-STA-0002](https://unit42.paloaltonetworks.com/tag/cl-sta-0002/ "CL-STA-0002")
* [CL-STA-0043](https://unit42.paloaltonetworks.com/tag/cl-sta-0043/ "CL-STA-0043")
* [Mimikatz](https://unit42.paloaltonetworks.com/tag/mimikatz/ "Mimikatz")
* [Mimilite](https://unit42.paloaltonetworks.com/tag/mimilite/ "Mimilite")
* [Ntospy](https://unit42.paloaltonetworks.com/tag/ntospy/ "Ntospy")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Exploring a Critical Risk in Google Workspace's Domain-Wide Delegation Feature](https://unit42.paloaltonetworks.com/critical-risk-in-google-workspace-delegation-feature/ "Exploring a Critical Risk in Google Workspace's Domain-Wide Delegation Feature")

### Table of Contents

* 

### Related Articles

* [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents")
* [CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/ "article - table of contents")
* [Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia](https://unit42.paloaltonetworks.com/espionage-campaign-against-military-targets/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")  
  ![Pictorial representation of malware bypassing DNS and communicating directly to IP addresses. Futuristic digital cityscape with glowing blue and orange geometric structures, resembling skyscrapers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 4, 2026 [#### Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/)

* [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control")

* [D2IP](https://unit42.paloaltonetworks.com/tag/d2ip/ "D2IP")

* [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "Almost Half of Malware Samples Communicate Direct to IP")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)